[FFmpeg-cvslog] bink: fix out of reference frame read

Michael Niedermayer git at videolan.org
Sat Jun 2 21:19:58 CEST 2012


ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sat Jun  2 19:56:10 2012 +0200| [b3675f890abee0bc446495711223a5c790234672] | committer: Michael Niedermayer

bink: fix out of reference frame read

Fixes Ticket1374

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b3675f890abee0bc446495711223a5c790234672
---

 libavcodec/bink.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/bink.c b/libavcodec/bink.c
index 8a9367d..4ad2e6f 100644
--- a/libavcodec/bink.c
+++ b/libavcodec/bink.c
@@ -1128,6 +1128,11 @@ static int bink_decode_plane(BinkContext *c, GetBitContext *gb, int plane_idx,
                 xoff = get_value(c, BINK_SRC_X_OFF);
                 yoff = get_value(c, BINK_SRC_Y_OFF);
                 ref = prev + xoff + yoff * stride;
+                if (ref < ref_start || ref > ref_end) {
+                    av_log(c->avctx, AV_LOG_ERROR, "Copy out of bounds @%d, %d\n",
+                           bx*8 + xoff, by*8 + yoff);
+                    return -1;
+                }
                 c->dsp.put_pixels_tab[1][0](dst, ref, stride, 8);
                 memset(dctblock, 0, sizeof(*dctblock) * 64);
                 dctblock[0] = get_value(c, BINK_SRC_INTER_DC);



More information about the ffmpeg-cvslog mailing list